Hacker News Reader

Comment by ChrisMarshallNY | Hacker News Reader

The best spam protection I ever had, was a bunch of hidden text input fields on my mail contact form, with names like “blindcopy”, “bcc”, “cc”, “additional address”, etc.

They all had default values.

If the submitting handler detected any values in these fields that were different from the default, the submission was rejected.

I don’t think I ever got a single bogus email from that form.

View on HN

Spam scripts are much less smart than that. I added a hidden field with no text in it to a contact form, and a polite warning as the hint text for accessibility. If anything was filled into that field the submission was silently dropped. I was cc-ed on any entries, and I believe there were 0 spam emails in the 8 years or so that the form was up.

I've heard this concept described as a "honeypot field" before and it works pretty well as you've said. I'm curious how password managers/autofill avoid tripping up though; are they able to detect that the field is not visible?

Password managers typically only fill specified fields - username & password - and leave others alone.

Maybe I'm thinking specifically of 1Password which can store your previously-filled out form fields as well as autofill fields like address or credit card number.

It would store the defaults, I suppose.

I got the idea from a book. Can't remember which, but it may have been in the early oughties, or even last century (and the book called it "Honeypot Fields").

The nice thing was, the user didn't have any friction at all. They had a subject and message. No CAPTCHAS, no math problems. Nothing.

The form was on a site with a fair bit of exposure and traffic. Another similar site used Contact Form 7 (or whatever the predecessor to it was), and we would get fairly regular spams. This was a plugin that I hand-crafted.

If it can detect HTML input fields and what to put in them, I'm sure it can also determine if a field is hidden (either by hidden property or styling) and avoid it?

Yeah I guess it depends on how sophisticated the "hiddenness" of the field is. Instead of straight up using the hidden property (which is easier for a bot to detect), you could try other things, like moving the input field offscreen and using overflow: hidden, or styling it such that it's the same color as the background and is unfillable. Now though you'll need to worrying about tabbing through fields (change tabindex to -1) and screen readers that might pick up the fields.

Doesn't even Hackernews employ something like this?

There are hidden input fields on the login page..

I did the same, worked wonders for me.

Reply on news.ycombinator.com